Box to Box Game - Privacy Policy

Privacy Policy for Box to Box - The Football Connections Game

Effective Date: 16 December 2025
Last Updated: 16 December 2025
Version: 1.0

1. Who We Are

Data Controller:
FinSpark Technologies Ltd
Company Registration Number: 16366811
Registered Address: 7 Shelford Avenue, Kirkby-In-Ashfield, Nottingham, England, NG17 8HF
Email: James@FinSpark.co.uk
Website: https://finspark.co.uk/

Data Protection Officer: We are not required to appoint a Data Protection Officer under Article 37 of the GDPR as we do not engage in large-scale systematic monitoring or process special categories of data at scale.

FinSpark Technologies Ltd ("we", "our", "us") operates the "Box to Box - The Football Connections Game" (the "App"). This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights regarding your data.

By using the App, you agree to the collection and use of information in accordance with this Privacy Policy.

2. What Information We Collect

We collect and process the following categories of personal data:

2.1 Data Collected Directly by the App

Gameplay Data:

• Game results,      scores, statistics, and routes chosen
• Progress and      achievement data
• User      preferences and settings
• Legal Basis: Contractual      necessity - this data is essential to provide the core functionality of      the App
• Storage: Stored      locally on your device only
• Retention: Until you      delete the App or use the "Delete Data" option in settings

Contact Data (if you contact us):

• Email address
• Name (if      provided)
• Content of      your inquiry
• Legal Basis: Consent - by      sending us an email, you consent to us processing this information to      respond to your query
• Storage: Stored in      our email system using Microsoft 365
• Retention: Deleted      within 90 days of query resolution

2.2 Data Collected by Third-Party Services

We integrate third-party services that collect personal data. These services have their own privacy policies and operate as independent data controllers or joint controllers.

Advertising Services:

FinSpark Technologies Ltd does not receive, access, or store this data; it is processed solely by Apple/Google in their capacity as independent controllers.

Google AdMob:

• Service      Provider: Google AdMob (operated by Google Ireland Limited)
• Data      Collected: Mobile advertising identifiers (IDFA on iOS, AAID on      Android), IP address, device model, operating system version, app usage      data, approximate location (country/city level based on IP address)
• Purpose: To serve      non-personalized advertisements within the App
• Legal Basis: Legitimate      interest - we have a legitimate interest in generating revenue to support      the App's development and maintenance. We have conducted a Legitimate      Interest Assessment which determined that serving non-personalized ads      does not override your fundamental rights and freedoms
• Their Privacy      Policy: https://policies.google.com/privacy
• Data      Transfers: Google may transfer your data to the United States      and other countries outside the EEA. These transfers are protected by      Standard Contractual Clauses and, where applicable, the EU-US Data Privacy      Framework
• Your      Controls: You can limit ad tracking through your device      settings (iOS: Settings > Privacy > Tracking; Android: Settings >      Google > Ads)

Apple Search Ads:

• Service      Provider: Apple Inc. (United States) / Apple Distribution      International Limited (Ireland)
• Data      Collected: 
  • Device       information: keyboard language settings, device type, operating system       version, connection type
  • Apple       Account information: gender, birth year, country/city (if provided)
  • App Store       activity: search queries, browsing activity (apps and content you view       and tap), download history, in-app purchases made through the App Store
  • Ad       interaction data: ads you view and tap (collected against a random       identifier not tied to your Apple Account)
  • Approximate       location: if Location Services is enabled and you've granted permission       to the App Store (approximate location only, not precise location)
  • User       segments: groups of people with similar characteristics based on the       above data
• Purpose: 
  • To display       relevant ads in the App Store based on your interests and App Store       activity
  • To measure       ad campaign effectiveness
  • To prevent       fraud and malicious activity
  • Apple's       advertising is either personalized (if you have "Personalized       Ads" enabled) or contextual (based on your current search/browsing)
• Legal Basis: Legitimate      interest - Apple has a legitimate interest in providing a competitive      search ads offering for app developers
• Data      Retention: Collected against random identifiers; specific      retention periods are determined by Apple
• Your      Controls: 
  • iOS/iPadOS:       Settings > Privacy & Security > Apple Advertising > Toggle       off "Personalized Ads"
  • To see why       specific ads were shown: Tap the "Ad" button on any ad
  • To view your       ad targeting information: Settings > Privacy & Security > Apple       Advertising > View Ad Targeting Information
• Privacy      Safeguards: 
  • Apple does       NOT track you across third-party apps or websites
  • Apple does       NOT share your personal data with advertisers or data brokers
  • Apple does       NOT use your Apple Pay transactions, Health app data, or HomeKit data for       advertising
  • Ad data is       collected using random identifiers, not tied to your Apple Account
• Their Privacy      Policies: 
  • General: https://www.apple.com/legal/privacy/
  • Apple       Advertising: https://www.apple.com/legal/privacy/data/en/apple-advertising/
  • App Store: https://www.apple.com/legal/privacy/data/en/app-store/

    

3. How We Use Your Data

We process your personal data for the following purposes:

1. To provide      the App's core functionality - storing your gameplay progress,      results, and preferences (Legal Basis: Contractual necessity)
2. To respond to      your inquiries - processing contact requests you send via email      (Legal Basis: Consent)
3. To serve      advertisements - displaying non-personalized ads to support the App      (Legal Basis: Legitimate interest)
4. To process      payments - facilitating purchases through app stores (Legal      Basis: Contractual necessity)

We do NOT use your data for:

• Direct      marketing or promotional communications
• Selling or      renting to third parties
• Profiling or      automated decision-making that produces legal or similarly significant      effects

4. Who We Share Your Data With

We do not sell, trade, or rent your personal data. We share data only in the following limited circumstances:

Third-Party Service Providers:

• Advertising      networks (as detailed in Section 2.2)
• Payment      processors (Apple, Google - as detailed in Section 2.2)

Legal Obligations: We may disclose your data if required to do so by law, court order, or to:

• Comply with      legal processes
• Protect our      rights, property, or safety
• Prevent fraud      or security threats
• Protect the      rights and safety of our users

5. International Data Transfers

EEA and UK Data Transfers:

While we do not directly transfer your data outside the European Economic Area (EEA) or United Kingdom, our third-party service providers may process data internationally:

• Google      (AdMob, Play Services): Transfers data to the United States      and other countries. These transfers are protected by:
  • Standard       Contractual Clauses (EU Commission approved)
  • The EU-US       Data Privacy Framework
  • UK       International Data Transfer Agreement
• Apple: Transfers      data to the United States and other countries. These transfers are      protected by Standard Contractual Clauses

You can obtain copies of these safeguards by contacting us at James@FinSpark.co.uk.

6. How Long We Keep Your Data

Gameplay Data: Stored locally on your device indefinitely until you delete the App or use the "Delete Data" option in App settings

Email Correspondence: Retained for 90 days after your query is resolved, then permanently deleted

Transaction Records: We retain transaction confirmations from app stores for 7 years to comply with tax and accounting legal obligations

Third-Party Data: Controlled by the respective service provider's retention policies (see their privacy policies)

7. Your Data Protection Rights

Under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, you have the following rights:

7.1 Right of Access (Article 15)

You can request a copy of the personal data we hold about you.

7.2 Right to Rectification (Article 16)

You can request correction of inaccurate or incomplete personal data.

7.3 Right to Erasure (Article 17)

You can request deletion of your personal data. For gameplay data, use the "Delete Data" option in App settings or uninstall the App. For email correspondence, contact us at James@FinSpark.co.uk.

7.4 Right to Restriction of Processing (Article 18)

You can request that we limit how we use your data in certain circumstances.

7.5 Right to Data Portability (Article 20)

You can request to receive your data in a commonly used, machine-readable format (CSV or JSON).

7.6 Right to Object (Article 21)

You can object to processing based on legitimate interests, including advertising. If you object to advertising, you may need to upgrade to the paid, ad-free version.

7.7 Right to Withdraw Consent

Where we process data based on consent (email contact), you can withdraw consent at any time by emailing James@FinSpark.co.uk. This does not affect the lawfulness of processing before withdrawal.

7.8 Right to Lodge a Complaint

You have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website:      https://ico.org.uk/make-a-complaint/
• Telephone:      0303 123 1113
• Address:      Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,      Cheshire, SK9 5AF

How to Exercise Your Rights

Response Time: We will respond to requests within 30 days. If your request is complex or we receive multiple requests, we may extend this by a further 60 days and will notify you.

Identity Verification: To protect your privacy, we may ask you to verify your identity before processing rights requests.

Fees: We do not charge fees for rights requests unless they are manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable fee or refuse the request.

To Submit a Request: Email James@FinSpark.co.uk with the subject line "Data Rights Request" and specify which right you wish to exercise.

8. Security Measures

We implement appropriate technical and organizational measures to protect your personal data:

Technical Measures:

• All data      transmission uses HTTPS encryption (TLS 1.2 or higher)
• Gameplay data      stored locally uses device-level encryption provided by iOS/Android
• Email      communications protected by Microsoft 365 enterprise security
• Access to      systems is restricted by multi-factor authentication

Organizational Measures:

• Access to      personal data limited to authorized personnel only on a need-to-know basis
• Regular      review of security practices

Limitations: No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Data Breach Notification: In the event of a data breach that poses a high risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours where required, and affected users without undue delay where there is a high risk to their rights and freedoms, in accordance with Article 34 of the UK GDPR.

9. Cookies and Tracking Technologies

Local Storage: The App uses local storage (similar to cookies) to save your gameplay data, preferences, and settings on your device.

Third-Party SDKs and Tracking: The App incorporates third-party Software Development Kits (SDKs) for advertising. These SDKs may use:

• Mobile      advertising identifiers (IDFA/AAID)
• Session      identifiers
• Technical      identifiers used to prevent fraud and ensure ad integrity

Your Choices:

• iOS Users: Settings      > Privacy & Security > Tracking > Toggle off for this App
• Android      Users: Settings > Google > Ads > Opt out of Ads      Personalization
• Limit Ad      Tracking: Both platforms allow you to limit ad tracking at the      system level

Do Not Track: The App does not respond to "Do Not Track" browser signals as it is a native mobile application.

10. Children's Privacy

The App is not directed at children. We do not knowingly collect personal data from children under the age of 13 (UK and US) or 16 (EEA countries where the age of digital consent is 16).

If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at James@FinSpark.co.uk. We will take steps to delete such data within 30 days.

Note: The gameplay nature of the App (football/soccer trivia) is generally appropriate for users of all ages, but we require users to meet the minimum age for digital consent in their jurisdiction.

11. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or service offerings.

Notification of Changes:

• Material      changes will be notified via in-app notification and by updating the      "Last Updated" date above
• We will      provide 30 days' notice for changes that materially reduce your rights
• Continued use      of the App after changes constitutes acceptance of the updated policy

Version History:

• Version 1.0 –      16 December 2025 - Initial policy

Previous versions are available upon request by emailing James@FinSpark.co.uk.

12. Legal Basis for Processing (GDPR Article 6)

We process your personal data under the following legal bases:

Data Type

Legal Basis

GDPR Article

Gameplay data

Contractual necessity - necessary to perform our contract with you to   provide the App

Article 6(1)(b)

Contact/email data

Consent - you provide explicit consent when contacting us

Article 6(1)(a)

Advertising data

Legitimate interest - we have a legitimate interest in generating   revenue. We have balanced this against your rights and implement safeguards   (non-personalized ads, opt-out options)

Article 6(1)(f)

Transaction records

Legal obligation - required for tax and accounting compliance

Article 6(1)(c)

Legitimate Interest Assessment: We have conducted a Legitimate Interest Assessment (LIA) for our advertising activities. The assessment concluded:

• Purpose: Generate      revenue to maintain and improve the App
• Necessity:     Non-personalized advertising is the least intrusive revenue method
• Balancing      Test: User impact is minimal (non-personalized ads only), users can      opt-out via device settings, and paid ad-free version available
• Safeguards: No      profiling, no behavioural tracking, transparent disclosure
• A copy of the      full LIA is available upon request

13. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data protection rights, or have concerns about how we handle your data:

Email: James@FinSpark.co.uk
Postal Address:
FinSpark Technologies Ltd
7 Shelford Avenue, Kirkby-In-Ashfield, Nottingham
NG17 8HF
United Kingdom

Expected Response Time: Within 30 days of receipt of your inquiry

14. Supervisory Authority

UK Users:
Information Commissioner's Office (ICO)
Website: https://ico.org.uk
Telephone: 0303 123 1113

EEA Users:
Directory of all EEA supervisory authorities: https://edpb.europa.eu/about-edpb/about-edpb/members_en